That still requires getting personal information about the user, which is often enough without 2FA. 2FA still makes it more secure than not having it. It's still a vulnerable step though, so users should be aware of that.

Start talking to someone at the credit Union. They are run by people, you might be able to convince them the risk and implement a safer method

I don't know about Google's "free" numbers, but third-party VOIP numbers are usually blocked for 2FA verification. I've tried that. Most places won't accept it, because they know you're trying to get around the tracking. The 2FA isn't the point, and the cost of the phone isn't the point, the tracking is the point, and Google's "free" numbers are absolutely tracking you just as effectively as any telecom is.